SF: fix off-by one in luma mean calculation

There was an off by one error in luma mean calculation that could
lead to segfault. Flaw was figured out in writing the 5 attached
unit tests for the function. Condition would be obscure in the wild,
but an exactly half-white, half-another-color in the sampled region
could present condition.

Fixes: 129858549
Test: libsurfaceflinger_unittest (5 new tests)

Change-Id: I920cd9cac15122178ec9258e33c9bc35b1bb9357

1 files changed, 2 insertions, 2 deletions

diff --git a/services/surfaceflinger/RegionSamplingThread.cpp b/services/surfaceflinger/RegionSamplingThread.cpp
index 718e996dae..35f11fc494 100644
--- a/services/surfaceflinger/RegionSamplingThread.cpp
+++ b/services/surfaceflinger/RegionSamplingThread.cpp
@@ -266,6 +266,7 @@ float getLuma(float r, float g, float b) {
     constexpr auto rec709_blue_primary = 0.0722f;
     return rec709_red_primary * r + rec709_green_primary * g + rec709_blue_primary * b;
 }
+} // anonymous namespace
 
 float sampleArea(const uint32_t* data, int32_t stride, const Rect& area) {
     std::array<int32_t, 256> brightnessBuckets = {};
@@ -286,14 +287,13 @@ float sampleArea(const uint32_t* data, int32_t stride, const Rect& area) {
 
     int32_t accumulated = 0;
     size_t bucket = 0;
-    while (bucket++ < brightnessBuckets.size()) {
+    for (; bucket < brightnessBuckets.size(); bucket++) {
         accumulated += brightnessBuckets[bucket];
         if (accumulated > majoritySampleNum) break;
     }
 
     return bucket / 255.0f;
 }
-} // anonymous namespace
 
 std::vector<float> RegionSamplingThread::sampleBuffer(
         const sp<GraphicBuffer>& buffer, const Point& leftTop,